From 712f837b569c2a77710cfef7eb9bdb8ba702adec Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 8 Oct 2026 19:50:56 +0200 Subject: [PATCH] ORGREF-WP-0002-T03: the backup token is the RPF-WP-0029 predecessor Already invalidated at the provider (2026-09-15); remaining work is removing the literal from two scripts. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 5457@bnt-lap001 Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012 --- inventory/history-exposure-2026-10-08.md | 29 +++++++++++++------ ...WP-0002-forge-closure-netkingdom-access.md | 5 +++- 2 files changed, 24 insertions(+), 10 deletions(-) diff --git a/inventory/history-exposure-2026-10-08.md b/inventory/history-exposure-2026-10-08.md index 2fc005a..230a91e 100644 --- a/inventory/history-exposure-2026-10-08.md +++ b/inventory/history-exposure-2026-10-08.md @@ -7,10 +7,10 @@ secret value, no commit author identity and no matched text. ## Result -283 findings in 25 repositories. After triage: **one real exposure**; everything -else is benign. +283 findings in 25 repositories. After triage: **one real exposure**, already +invalidated at the provider in September; everything else is benign. -### Real: hardcoded Nextcloud backup token (rotate) +### Real: hardcoded Nextcloud backup token (predecessor, cleanup remains) | Repository | File | Since | In current HEAD | | --- | --- | --- | --- | @@ -18,12 +18,23 @@ else is benign. | railiance-cluster | `tools/cmd/railiance-backup` line 11 | same value; file last changed 2026-07-07 | yes | `NC_TOKEN`, next to a Nextcloud URL, is the upload target for the backup tool. It -has been readable anonymously since February. Required, regardless of closing: -revoke and reissue it in Nextcloud, keep the new one in OpenBao only (this is -the same custody the CCR-2026-0004 offsite backup lane asks for: `NC_WEBDAV` -credentials in OpenBao), and remove the literal from both scripts. Removing it -from HEAD does not remove it from history or from clones; the revocation is the -fix. Routed to railiance-bootstrap and railiance-cluster (hub messages). +has been readable anonymously since February. + +**Already handled at the provider (correction, same day).** By age and target this +is the predecessor credential of railiance-platform `RPF-WP-0029` (finished). +That plan removed the same literal from `tools/cmd/forgejo-backup` and moved +backups to a dedicated Backup account with an upload-only share. The governed +token lives in OpenBao at `platform/workloads/railiance/backup/offsite-lane` +(CCR-2026-0004; rotation: `warden rotate-guide railiance-backup-offsite-lane`). +The operator attested on 2026-09-15 that the old personal share was unshared. +Value identity was not compared (RPF-WP-0029 forbids recording fingerprints), +so the founder confirms in Nextcloud that no personal share remains on the +backup folder. + +Remaining: **cleanup, not rotation.** Remove the literal from both +`railiance-backup` copies (read the governed lane, as `forgejo-backup` does) or +retire the script. Routed to railiance-bootstrap and railiance-cluster (hub +messages, with a correction to the first "revoke now" wording). ### Benign (no action) diff --git a/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md b/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md index 8443f38..86b94f9 100644 --- a/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md +++ b/workplans/ORGREF-WP-0002-forge-closure-netkingdom-access.md @@ -198,7 +198,10 @@ and results without reproducing any value. repositories: 283 findings in 25 repositories. One real exposure: a Nextcloud backup token (`NC_TOKEN`) hardcoded in `tools/cmd/railiance-backup` in railiance-bootstrap and railiance-cluster, public since 2026-02-25 and still in -HEAD. Routed to both owners for revocation, OpenBao custody and removal. The +HEAD. It is the predecessor credential of railiance-platform RPF-WP-0029, +whose old share was attested unshared on 2026-09-15; what remains is removing +the literal (routed to both owners), plus a founder check in Nextcloud that no +personal share remains. The rest is benign (identifiers, digests, test fixtures, placeholders). Record and limits: `inventory/history-exposure-2026-10-08.md`. The rotation is tracked with the owners.